Summary form only given. Actually, there is growing consensus that for many system applications, safety as well as security demands have to be observed in a coherent manner. We describe such an integrated approach to protect the nodes of distributed cooperative systems against malicious attacks and unplanned system failures. The basic strategy is the use of special diagnostic agents for that purpose. This agent concept is supported by means of additional diagnostic units modularly added to the processor/memory interface of each node of the system. These units have their own autonomous control which cannot be altered by their corresponding processor. Each instruction transferred to the processor, and each data word transferred to/from the processor, in a side step can be scanned by the diagnosis unit. In case of a suspicion for malicious or nonmalicious faults, the diagnosis unit can lake over control of the corresponding processor to run diagnostic routines, and can trigger bootstrap or recovery procedures to restore a proper state of the processor of the node. The diagnostic unit also can communicate with the diagnostic units of the other nodes about the slate of the entire system. Thus, after detecting suspicious behaviour in its own node, by alarming the diagnostic units of the other nodes, further spreading of an attack is tried to be hindered. Even in case the attack spreads quicker within the system than the diagnosis can initially assess and confine it, the cooperating diagnostic units remain a functioning distributed hardcore which can start and carry out a recovery of the system. The resulting impact on system reliability is derived; here also a modelling approach is discussed to describe especially malicious intrusion faults in a more refined way, by distinguishing different classes of attackers. The resulting reliability of the presented architecture is sketched.

A method to systematically integrate fault tolerance properties into the design of complex software systems is presented. The method exploits a formal specification of the system in which the amount of necessary redundancy can be determined. The system description is based on a combination of a predicate/transition net with regular expressions. The net model provides a formal overview of the system behavior in general, supporting the correct understanding of potential concurrency in the system processes. Regular expressions are used to model the sequential behavior of single-system components in detail. Both model layers provide well-defined levels of error detection; the regular expressions enable the system designer to also determine and introduce redundancy to achieve error correction. The techniques used to describe and analyze system behavior are explained using a case study that contains a stepwise-refined specification and analysis of a multistory shelving system model that has been implemented using the method presented. It is shown that the method applies to any software system which is to be protected against the considered errors.>

The following paper is to present a test and reconfiguration strategy for fault-tolerant VLSI processor systems. This is accomplished with respect to the requirements imposed by the VLSI technology. The proposed concept is exemplified by a model composed of four microprogrammable processors each with a local memory. The test strategy of a gradually expanding hardcore is applied where the central hardcore consists of a small test unit of low complexity. This test unit enables each processor to diagnose autonomously its data path structure and its associated local memory. A particular reconfiguration scheme is proposed for these components. It is implemented at microprogram level. As a result, compared with other fault-tolerance techniques, system reliability is considerably improved.